3ea350fa6916e36ba67a8a17a347bb89ab2567120eb9af4cf6648c1809711274

Analysis

max time kernel
1203s
max time network
849s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
20/07/2023, 05:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1d81c09d8249410587ae.zipab
Size

276B
MD5

b77d99b77e2e0dcd5eac98788b6e2ba7
SHA1

75d8f49b5c29c4dc35eb94a5e9c4f9ffe0a7e42e
SHA256

4e6480b2291807d664c8e906ce9ed8546c07ac69e8bc194bcc87664731137607
SHA512

f71bba6a2c80256408b959b1b62fb48da74f6fe5cd2c2123f4ed2cdb3389a7f19231407f5fde3729e837602ce88531f7b4e63654d8bd18044c94035172127487

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\zipab_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\zipab_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\zipab_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\zipab_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\zipab_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\.zipab\ = "zipab_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\zipab_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\.zipab	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2576	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2576	AcroRd32.exe
2576	AcroRd32.exe
2576	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2368	2444	cmd.exe	29
PID 2444 wrote to memory of 2368	2444	cmd.exe	29
PID 2444 wrote to memory of 2368	2444	cmd.exe	29
PID 2368 wrote to memory of 2576	2368	rundll32.exe	30
PID 2368 wrote to memory of 2576	2368	rundll32.exe	30
PID 2368 wrote to memory of 2576	2368	rundll32.exe	30
PID 2368 wrote to memory of 2576	2368	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\1d81c09d8249410587ae.zipab
1⤵
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\1d81c09d8249410587ae.zipab
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2368
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\1d81c09d8249410587ae.zipab"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2576

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c0ec194c4e4b91add60dd44cb036f89f

SHA1
67846b601f4223364cf77dccf4ef09a15c3acd97

SHA256
7c0914c55c15c4e2dc5fa64da2d4c556b6b518404af5fc7db3b11dde8c6cc74e

SHA512
72c2f63882c9ca8d2e022e63959fdda88d76be9152afbac5060b4d9bacab2efb5127dfb4815809a99dad5a562f829dfed57b93a617cadb8f9be6132afc5a5061

Download Submit